❌

Normal view

Received — 17 September 2026 ⏭ Tech

Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root

✇The Hacker News
By: [email protected] (The Hacker News)
17 September 2026 at 13:08
A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and says it has no indication that the flaw

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

✇The Hacker News
By: [email protected] (The Hacker News)
17 September 2026 at 12:32
Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lying around. Both work often enough. So the threat landscape is not getting cleaner. It is just

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

✇The Hacker News
By: [email protected] (The Hacker News)
17 September 2026 at 10:37
Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. The escape runs with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated Critical, affects versions

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

✇The Hacker News
By: [email protected] (The Hacker News)
17 September 2026 at 09:03
The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading,

Ex-Google DeepMind Researcher Also Warns AI Could 'Kill All Humans'. But Meta's Zuckerberg Believes Safety is Up to Each AI Company

✇Slashdot
By: EditorDavid
17 September 2026 at 20:04
Reuters reports that a former Google DeepMind employee "became the latest AI researcher to warn that the technology could 'kill all humans', saying time could be running out to avoid the outcome: Public alarm about the potential danger posed by AI is growing, after Anthropic researcher Jacob Coxon said last week he had resigned, in part because the "people building AI earnestly believe that it could kill us all by the end of the decade." Anthropic scientist Evan Hubinger then responded to Coxon's comments, saying he was correct and that he believed there was a greater than 10% chance that AI could kill all humans within the next decade. "I recently resigned from Google DeepMind, where I worked on AGI safety and alignment research," Bilal Chughtai wrote on X. "I earnestly believe that AI has the potential to kill us all, and that we might be running out of time to avoid this outcome." Chughtai, who co-authored research papers while at Google DeepMind, worked there as a research engineer and left the company in July 2026, according to his LinkedIn profile. Meanwhile, Meta CEO Mark Zuckerberg "said it's up to each AI company to make sure its technology is safe," reports the Associated Press, "distancing himself from calls by rival companies for a coordinated slowdown in the development of advanced artificial intelligence. AI companies are already motivated to develop their models in a safe way and face "significant liability" to prevent them from causing harm, Zuckerberg said. "Every lab has the responsibility and incentive to move at the pace required to train its models safely, and the ability to take its own actions to ensure that happens," he wrote on X... Zuckerberg said Meta delayed releasing its Muse AI agent for several months to ensure its safety and security. "We didn't call for everyone else to do this before we would," he said. Companies should prioritize building safe AI models instead of systems that can automatically improve themselves, a function known as recursive self-improvement, Zuckerberg wrote. "Committing the significant majority of compute towards serving people rather than racing towards recursive self-improvement is one of the best ways to ensure we develop this technology safely." But Zuckerberg also agreed that engaging independent evaluators and advisors "is industry best practice," adding that Meta Superintelligence Labs "already does this today in several areas because it helps produce better work... "I believe the key to building a positive future for everyone is maintaining the right balance of power. This is within our power to do."

Read more of this story at Slashdot.

Iran Strikes On Amazon Data Centers Caused Permanent Loss of Customer Data

✇Slashdot
By: EditorDavid
17 September 2026 at 15:34
Ars Technica reports: Half a year after Iranian drone strikes knocked out multiple Amazon data centers, the US tech company has acknowledged the permanent loss of some customer data that was hosted in Bahrain and the United Arab Emirates. Amazon Web Services was "unable to restore access to the resources and data" hosted in some of the war-damaged data centers, according to an AWS dashboard update posted on September 15. The development was first reported by Reuters and suggests that the Iranian strikes inflicted catastrophic damage on the data centers. Customer data was irretrievably lost in one of three AWS availability zones in the United Arab Emirates region, specifically the mec1-az2 availability zone. Each availability zone is serviced by one or more Amazon data centers. The company is still working on "recovering regional resources" and restoring resources hosted in the other two availability zones in the United Arab Emirates... But the destruction was apparently even more widespread for the data centers in the Bahrain region, because Amazon said it was unable to restore access to resources and data across all three availability zones there. "The damage to our infrastructure spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand," the AWS update said. The company had already suspended customer billing in the affected AWS regions in Bahrain and the United Arab Emirates and has spent the past six months attempting to restore normal operations... [When the war began] AWS immediately urged customers to migrate resources to other cloud regions and use remote backups to restore any "inaccessible resources." The cloud service also reportedly issued $150 million in customer credits following the initial Iranian strikes in March.

Read more of this story at Slashdot.

I built a self-hosted CRM that reads my mailbox, because my customer history was 13,000 emails and a gut feeling

✇CRM - Customer Relationship Managment
By: /u/reloopcrm
17 September 2026 at 12:01

I run a small freight forwarding company. Our customer history was a mailbox: who asked for 700 pallets, where a thread went quiet, which company bought three times and has not written since spring. Every CRM I tried wanted me to type all of that in by hand, so none of them lasted a month.

So I spent the last months building one that reads the mailbox instead. It connects over IMAP, Gmail or Microsoft 365, reads the history once, keeps it in sync, and remembers what each thread was about: deals closed, inquiries left open, quantities, products. From that it builds one list of companies worth another try.

On my own install: 13,688 conversations read, 181 companies enriched, 178 people with a real reason to call again.

Some notes for this sub specifically:

Everything runs on your machine. Postgres, the API, the app and the agent, four containers, one command to start. About 430 MB to pull, amd64 and arm64, runs fine on a 4 GB VPS.

The AI part is optional and it is yours. You paste an OpenRouter, OpenAI or Anthropic key, or you paste nothing and keep a normal CRM without summaries. Without a key nothing leaves the machine.

License is AGPL-3.0. Docs are at reloopcrm. com/docs, install is documented, and there is a rollback path in there too.

What it is not: it is early, I am the main user, there is no mobile app, no import from another CRM yet, and the win-back ranking is my own scoring, not something proven on other businesses.

Repo: github. com/reloopcrm/reloop

If you self-host something with a mailbox in it, I would like to hear where this breaks for you.

submitted by /u/reloopcrm
[link] [comments]

Suddenly, I am managing a CRM setup lol

✇CRM - Customer Relationship Managment
By: /u/Ill_Vegetable_4136
17 September 2026 at 04:06

I just got asked to "do" CRM setup. I worked with the founder previously and they want me to come on to do something I honestly haven't done. They know this and said "just give it a try" lol.

The company has like 4 pieces of software that different teams are using to manage their departments (apartment renting software (pipedrive), some vacation rentals (cloudbeds), gym software (trybe), cafe software (sevenrooms), conference room booking, and events), it's a luxury apartment compex. I have set up a customer support CRM in the past and sales CRM in salesforce, but I am just lost. Nothing reliably feeds into their central CRM except the conference room bookings, but it's one way.

Would anyone lend me their time or advice on how to set this up? I can chat whenever, if you can warn me of pitfalls lmk.

Basically we have a TON of data in the cafe about the persona and each person bc they research people and tag them, so that's an interesting piece.

Right now I am making sure

  1. All the tags / classifications are uniform across the systems
  2. All the tags have a home in hubspot and are organized
  3. The de-duping is working in the CDP (customer data platform)
  4. And most of all, our CRM is midway through an integration sevenrooms (cafe) and trybe (gym), but management is getting impatient. Should I try to build something with Zapier...? Or just leave it and upload manually in the meantime to make sure my framework makes sense...?

The conference room data and events has no integration slated

submitted by /u/Ill_Vegetable_4136
[link] [comments]

Help a girl out - Got thrown a CRM job

✇CRM - Customer Relationship Managment
By: /u/Ill_Vegetable_4136
17 September 2026 at 03:59

I just got asked to "do" CRM setup. I worked with the founder previously and they want me to come on to do something I honestly haven't done. They know this and said "just give it a try" lol.

The company has like 4 pieces of software that different teams are using to manage their departments (apartment renting software (pipedrive), some vacation rentals (cloudbeds), gym software (trybe), cafe software (sevenrooms), conference room booking, and events), it's a luxury apartment compex. I have set up a customer support CRM in the past and sales CRM in salesforce, but I am just lost. Nothing reliably feeds into their central CRM except the conference room bookings, but it's one way.

Would anyone lend me their time or advice on how to set this up? I can chat whenever, if you can warn me of pitfalls lmk.

Basically we have a TON of data in the cafe about the persona and each person bc they research people and tag them, so that's an interesting piece.

Right now I am making sure

1) All the tags / classifications are uniform across the systems

2) All the tags have a home in hubspot and are organized

3) The de-duping is working in the CDP (customer data platform)

4) And most of all, our CRM is midway through an integration sevenrooms (cafe) and trybe (gym), but management is getting impatient. Should I try to build something with Zapier...? Or just leave it and upload manually in the meantime to make sure my framework makes sense...?

The conference room data and events has no integration slated

submitted by /u/Ill_Vegetable_4136
[link] [comments]

Hackers Stole Flock's Camera Software, Revealing How the Company Tracks Cars and People

✇Slashdot
By: EditorDavid
17 September 2026 at 11:04
"Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and shared the files with 404 Media and WIRED," according to an article published on both sites. Though Flock has described its system as protected by on-device encryption, "The hackers were able to copy the camera's storage and recover an encryption key stored on the device, which unlocked videos of thousands of vehicle detections." The hackers shared the material with 404 Media and the transparency nonprofit Distributed Denial of Secrets, which shared the data with WIRED. 404 Media and WIRED then analyzed those files as part of a joint investigation... [T]he joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles. The camera can produce dozens of images of a single passing vehicle and, according to several weeks of recovered logs, generated more than a million images. Its computer-vision software also sometimes isolated bumper stickers and other graphics, including, in one case, an American flag patch on a motorcyclist's saddlebag... According to our analysis, the camera's logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454... The software running on the camera explicitly detects people, something which is typically overlooked in discussions around Flock cameras. When it spots a person, it records where they appear in the image and how confident it is in the detection. It was a collective calling itself stegan0gram that breached the cameras, according to the interview they did with Wired and 404 Media. "Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?"

Read more of this story at Slashdot.

Prospect Legend : Keep your data to yourself !

✇CRM - Customer Relationship Managment
By: /u/Amazing_bun7958
17 September 2026 at 09:21

Hi everyone,

If you're looking for something straightforward and easy to use for cold calling and cold mailing without dealing with bloated, pricey cloud software, you might want to take a look at Prospect Legend (a tool I’ve been building, currently in beta).

I used to work at a call center a while back, and when I searched for a simple solution for my own prospecting needs, I found most tools are either too expensive for my needs or packed with unnecessary features. I relied on Excel sheets for a while, but tracking data over time can get a bit messy.

So, I built a no-nonsense tool that is 100% local for Windows, designed to avoid heavy setups or account creations, for solopreneurs or very small teams :

  • Direct Excel/CSV Integration: It reads and updates your local .xlsx files directly, featuring file locking and automatic backups.
  • Streamlined Workflow: Includes an integrated auto-dialer, quick status logging (No answer, Subscribed, Refused), an appointment planner, and handles 4 email templates to pre-fill follow-up pipelines in one click.
  • Native Protocols: Launches actions directly from your default phoning and mailing apps.
  • Gamified Sessions: Features a gamified system (XP points, combos) to keep morale going during calling sessions.

FULL DISCLOSURE:

  • The interface is currently in French

    (English version coming very soon)

  • . Obviously, if there is enough interest from this community, I'll probably translate the whole thing into English!

  • No Cloud Sync: It operates using structured local .xlsx file rather than live native syncs with tools like Salesforce or HubSpot.

I’m looking for a few people (8 – 12 ppl) to test out the beta.

If you're open to testing it during a 30-day free trial period and sharing some much-appreciated feedback, DM me and I'll send over the link to the beta test recruitment page.

Have a great day, and thanks for reading!

submitted by /u/Amazing_bun7958
[link] [comments]

[Weekly] CRM Rant/Rave Thread - What's great/awful in CRM for you this week?

✇CRM - Customer Relationship Managment
By: /u/woodss
17 September 2026 at 08:30

This is a weekly post for you to let out about something which happened this week for you in CRM that mattered: features, client requests that were either great or awful this week, and just generally chat CRM / CRM consulting chatter.

No self promo, just a place to share tales from the front-line of CRM!

submitted by /u/woodss
[link] [comments]

Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

✇The Hacker News
By: [email protected] (The Hacker News)
17 September 2026 at 07:30
Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Unbound 1.26.1, released the same day, fixes the bug, tracked as CVE-2026-81642, along with

Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar

✇The Hacker News
By: [email protected] (The Hacker News)
17 September 2026 at 06:50
A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time between disclosure and working exploitation, while many security programs still validate risk on weekly or quarterly cycles. The dangerous gap is no longer just technical. It is

CISO's Expert Guide to Agentic Pentesting for Websites

✇The Hacker News
By: [email protected] (The Hacker News)
17 September 2026 at 05:50
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one at production. TL;DR Exploitation is now the front door. It starts 31% of breaches (Verizon DBIR

❌